用户审计

最新推荐文章于 2022-09-02 14:47:33 发布

weixin_33709219

最新推荐文章于 2022-09-02 14:47:33 发布

阅读量175

点赞数

原文链接：https://my.oschina.net/u/2343310/blog/730752

版权

2019独角兽企业重金招聘Python工程师标准>>>

vim /etc/bashrc

HISTFILE="/data/log/.user"
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTFILE'

第二种：

HISTTIMEFORMAT="%Y/%m/%d %T ";export HISTTIMEFORMAT

export HISTORY_FILE=/data/log/user_audit/user_audit.log

export PROMPT_COMMAND='{ thisHistID=`history 1|awk "{print \\$1}"`;lastCommand=`history 1| awk "{\\$1=\"\" ;print}"`;user=`id -un`;whoStr=(`who -u am i`);realUser=${whoStr[0]};logMonth=${whoStr[2]};logDay=${whoStr[3]};logTime=${whoStr[4]};pid=${whoStr[6]};ip=${whoStr[7]};if [ ${thisHistID}x != ${lastHistID}x ];then echo -E `date "+%Y/%m/%d %H:%M:%S"` $user$$realUser$@$ip[PID:$pid][LOGIN:$logMonth $logDay $logTime] --- $lastCommand ;lastHistID=$thisHistID;fi; } >> $HISTORY_FILE'

who -u am i 获取的是实际用户

id -un 获取的是当前操作的用户，比如切换到root，但是要获取实际用户的得用上面那个

转载于:https://my.oschina.net/u/2343310/blog/730752